Loading malware…
Shai-Hulud is a self-propagating credential-stealing worm targeting the npm software supply chain. Discovered in September 2025, it compromises developer workstations, application servers, and CI/CD runners through malicious releases of legitimate packages. Installation lifecycle scripts execute its payload without requiring the affected library to be imported. The worm uses stolen npm publishing credentials to enumerate packages maintained by victims, inject malicious code, and publish infected releases, extending the compromise to downstream users and dependencies.
Shai-Hulud harvests npm and GitHub tokens, SSH keys, API keys, environment variables, and credentials for AWS, Azure, GCP, Kubernetes, Docker, and HashiCorp Vault. It has used the legitimate TruffleHog secret-scanning utility to discover credentials. Later variants also target browser data, cryptocurrency-wallet secrets, messaging application data, and AI-development-tool configurations. Stolen information is exfiltrated to attacker-controlled infrastructure or uploaded to public GitHub repositories. Malicious GitHub Actions workflows enable continued collection of repository and CI/CD secrets, while backdoored runners and modified development-tool configurations provide additional persistence.
Later variants use heavily obfuscated JavaScript executed through the Bun runtime and support remotely supplied code execution. Variants associated with ChainDrop use an actor-controlled Ethereum smart contract to resolve command-and-control infrastructure and GitHub as a fallback staging channel. Some include a persistent monitor that checks a stolen GitHub token and can trigger destructive deletion of the infected user's home directory when that token becomes invalid. The family operates across Windows, macOS, and Linux environments. Its principal targets are software developers and organizations with access to package registries, source repositories, cloud services, and automated release systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
MITRE CONTEXT — Exploits Vulnerabilities: CVE-2024-3400. Threat Names: Shai-Hulud.
MITRE CONTEXT — Exploits Vulnerabilities: CVE-2021-4436. Threat Names: Shai-Hulud.
MITRE CONTEXT — Exploits Vulnerabilities: CVE-2023-46747. Threat Names: Shai-Hulud.
MITRE CONTEXT — Exploits Vulnerabilities: CVE-2024-1709. Threat Names: Shai-Hulud.
MITRE CONTEXT — Exploits Vulnerabilities: CVE-2025-0282. Threat Names: Shai-Hulud.
CVE-2025-10894 highlights how a single workflow misconfiguration can cascade into widespread compromise across the JavaScript ecosystem. The attack chain for CVE-2025-10894 began with exploitation of a GitHub Actions workflow in the Nx repository. The workflow used the pull_request_target trigger, which grants elevated permissions (including a writable GITHUB_TOKEN) to workflows running on pull requests from forks. Attackers crafted pull requests with titles containing bash injection payloads. | The campaign escalated with the release of a self-replicating worm (Shai-Hulud) that used harvested npm credentials to infect additional packages, resulting in over 500 compromised npm projects.
Shai-Hulud is a self-propagating, info-stealing malware that infects software components, uses the access to publish poisoned versions, and then harvests the repository accounts of those affected by the malware downstream.
359 GitHub repos created with encrypted stolen credentials — “Shai-Hulud: Here We Go Again.” CVE-2026-45321 published CVSS 9.6 critical. Mitre, CISA, and major registry operators issue coordinated advisories. | Shai-Hulud is, at this point, a very familiar name... The most recent one being the so-called Mini Shai-Hulud... they are back again... compromising the TanStack Router packages, and starting a brand new campaign based on Mini Shai-Hulud.
In the Shai-Hulud incident, the compromised packages (MAL-2025-46974 and CVE-2025-59144) were identified early, providing actionable findings that customers could remediate quickly.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A malicious version of tensorlake (version 0.5.144) was hijacked with Shai-Hulud malware.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The group often uses a purpose-built, self-replicating npm worm it developed called Shai-Hulud to infect GitHub projects.
researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide.
A new wave of the Shai-Hulud supply chain campaign, adding 23 newly discovered malicious PyPI package-version artifacts to an already alarming operation that previously compromised 37 packages.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
These credentials are then encoded and exfiltrated to attacker-controlled endpoints.
The S1ngularity script exfiltrated Nx's NPM token; Shai-Hulud and CanisterWorm searched victim machines for npm tokens to publish malicious versions of associated packages.
These credentials are then encoded and exfiltrated to attacker-controlled endpoints, as well as uploaded to a public GitHub repository named Shai-Hulud.
286 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A worm described as spreading across approximately 100 repositories after a hijacked AI coding assistant session installed a poisoned package. The article uses this incident to illustrate AI-assisted software supply-chain risks.
An npm supply-chain worm distributed through the compromised tensorlake@0.5.144 release. Malicious commits were pushed under a maintainer's name before the legitimate release workflow built and published them, resulting in valid provenance rather than forged attestations. A preinstall hook executes an obfuscated loader, lib/setup.mjs, which fetches a Bun runtime; the second stage is lib/Math_Symbol.js. The payload collects npm tokens, SSH keys, AWS/GCP/Azure credentials, kubeconfigs, GitHub and CI tokens, and .env files. It propagates by using stolen npm tokens to republish compromised packages and includes a destructive failsafe triggered by revocation of its GitHub token. The content states that disabling installation scripts blocks this payload and that a 72-hour minimum-version-age gate would have delayed installation until after the package's takedown.
Referenced as a comparison for cascading software supply-chain attacks involving compromised npm packages. The article does not report Shai-Hulud being deployed through the disclosed trusted-publishing loophole.
The reported variant compromises developer workstations and CI/CD runners through tensorlake@0.5.144. A preinstall dropper downloads Bun and executes the core payload, which steals browser data, cryptocurrency wallet information, and development and cloud credentials. It persists through IDE tasks and AI-agent configuration changes, uses an Ethereum smart contract to retrieve fallback C2 destinations, and stages stolen data through GitHub repositories if other channels fail. Stolen publishing credentials enable propagation into additional npm packages and repositories. A background monitor reportedly triggers destructive wiping when a stolen GitHub token becomes invalid. The malicious Tensorlake release carried valid Sigstore provenance, demonstrating that build provenance alone does not establish code safety.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.